Topic starter
16/01/2026 2:19 pm
TL;DR: AI adoption is happening outside traditional approval flows, and the result is shadow AI, embedded AI in everyday apps, and inconsistent controls that leave sensitive data and connected systems exposed, according to Wing Security's analysis. The governance problem is not visibility alone, but the lack of continuous context, policy enforcement, and response across identity and data pathways.
Editorial analysis by NHI Mgmt Group, based on content published by Wing Security: “AI without governance is a breach waiting to happen”.
Key questions
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Q: Why do embedded AI features increase identity risk in SaaS stacks?
A: Embedded AI increases identity risk because it inherits permissions from the surrounding application and can act at machine speed across data and workflows.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Implement continuous AI discovery Continuously scan SaaS, browser-based apps, and embedded AI features so newly adopted tools appear in the governance inventory as soon as they are used.
- Classify AI tools by connected systems Assign risk based on whether an app touches CRM, file stores, collaboration platforms, or other sensitive systems, not just whether it contains an AI feature.
- Enforce data-sharing guardrails Block or warn when users try to send sensitive information to generative AI tools, and require explicit policy exceptions for approved use cases.
Bottom line: Shadow AI becomes a governance failure when discovery does not keep pace with how quickly employees can adopt new tools and embedded AI features.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:44 pm
Continuous discovery is now the first governance control for AI use. The article shows that AI adoption is no longer contained inside approved procurement or deployment paths. That creates a shadow AI problem where the organisation cannot govern what it cannot continuously see. The implication is that discovery has become an identity and access prerequisite, not a separate hygiene task.
A few things that frame the scale:
- Companies using AI governance put over 12 times more AI projects into production, according to a Databricks report.
A question worth separating out:
Q: When should organisations block an AI app instead of approving it?
A: Block an AI app when its access scope, data handling, or downstream integrations exceed the organisation's risk tolerance and cannot be constrained with policy. If the app touches sensitive systems, lacks credible security posture, or can widen access dynamically, approval should wait until controls can be enforced at runtime.
👉 Read our full editorial: AI governance gaps are exposing shadow AI and embedded app risk